In March 2022, PCI DSS launched a 4.0 version, which sets the operational and security standards for users. This new version is the replacement for the 3.2.1 variant. The authorities have upgraded the version to enhance security measures and help individuals and businesses handle growing security threats seamlessly.
Financial companies have been sending feedback for the inefficient payment systems, due to which the PCI DSS launched a new security version PCI-DSS v4.0.
What's New in the Latest PCI DSS Version?
All companies must implement the security standards changes according to the PCI-DSS 4.0 before March 2025. This next-gen security policy has the following objectives:
To address the threats experienced by the payment industry
- Two-factor authentication has become compulsory
- New password requirements
- New phishing standards and eCommerce security practices are launched
To introduce robust security measures
- Special guidance to make it easy for people to understand the new security standards and learn about the ways to implement robust security protocols
- Transparent and detailed reports help people understand the areas they can improve.
Promote innovation in the payment industry to make the sector more flexible
- Offer risk analyses to help organizations set the frequency of executing certain security operations.
- Customized security standards
- Changes in the permission settings for group, public, and shared accounts
Let's take a look at the summary of all the changes implemented in the PCI DSS 4.0. Note that it's only a brief summary, and the detailed reports of the revision can be found on the company's website.
- The core requirement for security protocols has been changed. The network security controls are launched in place of the firewalls and other traditional security measures. This update allows a wider range of security technologies to be implemented in the payment system.
- The focus has been shifted from the default security practices to the advanced security configurations.
- Changes to make account data more secure.
- Improved cryptography practices to ensure that the data submitted by the cardholder is safe.
- Updated security practices to protect the device from malware and other virus attacks. The anti-virus programs in 3.2.1 are replaced by the anti-malware programs designed to cover a wider range of technologies and security practices to make the system better and safer.
- Audit logs are being launched in place of audit traces
- The corporate programs added to the PCI DSS 4.0 focus more on the information technology than the previous variant
- The multi-factor authentication has become compulsory.
What does PCI-DSS Solve?
The PCI-DSS 4.0 version aims to address the industry feedback from financial companies and authorities. This version furthers the protection of payment data with new controls to address sophisticated cyber attacks.
Image: PCI-DSS-v4-0-At-A-Glance
PCI DSS v4.0 Requirement 2 has an updated principal requirement title to reflect that the focus is on secure configurations in general, and not just on vendor-supplied defaults. Requirement 2 states organizations should: "Apply Secure Configurations to All System Components."
Requirement 2.2: "System components are configured and managed securely." Defined Approach Requirements are:
2.2.1 Configuration standards are developed, implemented, and maintained to:
- Cover all system components.
- Address all known security vulnerabilities.
- Be consistent with industry-accepted system hardening standards or vendor hardening recommendations.
- Be updated as new vulnerability issues are identified, as defined in Requirement 6.3.1.
- Be applied when new systems are configured and verified as in place before or immediately after a system component is connected to a production environment.
Automate your server hardening process
CHS is an automated hardening solution by CalCom that is designed to address the needs of IT Operations and Security teams. It significantly reduces operational costs and eliminates the risk of production downtime by indicating the impact of a security baseline change directly on the production environment. CHS saves the need for testing changes in a lab environment before pushing them to production.
CHS will help you easily achieve compliance with PCI-DSS requirement 2.2., Reduce IT administration costs for server hardening tasks and ensure continuous compliance with known hardening standards while avoiding system crashes and outages
